---
title: "Ignore security finding"
method: POST
path: "/api/apps/{app_id}/security/scan/ignore"
---

# Ignore security finding

`POST /api/apps/{app_id}/security/scan/ignore`

## Request

- Base URL: `https://app.base44.com`
- URL: `https://app.base44.com/api/apps/{app_id}/security/scan/ignore`
- Auth: HTTP bearer

<Info>This API is in beta. Endpoints, fields, and behavior may still change, so avoid depending on it in production.</Info>

Ignores one [finding](/developers/references/apps-api/sections/security#scan-findings) in the app's security scan, so it stays hidden across rescans for as long as its [fingerprint](/developers/references/apps-api/sections/security#findings-and-fingerprints) doesn't change. Get the finding's `fingerprint` from [Get security scan](/api-reference/get-security-scan), and send the `finding_type` for its group.

Ignoring doesn't change the app, and it doesn't remove the finding from the scan result. The finding stays in its list, and its fingerprint is added to `ignored_fingerprints`. The app editor hides findings whose fingerprint is there. To undo an ignore, use [Restore security finding](/api-reference/restore-security-finding).

A successful call doesn't confirm that the finding is now ignored. Base44 doesn't check that `fingerprint` belongs to a finding, so a mistyped or outdated one is saved and returns the same response. Check that the finding's `fingerprint` appears in `ignored_fingerprints`.

## Path parameters

- `app_id` string, required: ID of the app.

## Request body

- IgnoreFindingPayload: The security finding to ignore.
  - `fingerprint` string, required: The finding's [fingerprint](/developers/references/apps-api/sections/security#findings-and-fingerprints), as returned by [Get security scan](/api-reference/get-security-scan). Up to 128 characters.
  - `finding_type` string, required: The finding's [type](/developers/references/apps-api/sections/security#scan-findings), which matches the group it came from in [Get security scan](/api-reference/get-security-scan). Any other value is accepted and nothing is recorded.
  - `file_path` string: Path of the file the finding points at, kept with the ignore as a record of what was ignored. Up to 1,024 characters. Defaults to an empty string.
  - `title` string: Short name for the finding, kept with the ignore as a record of what was ignored. Up to 2,000 characters. Defaults to an empty string.

## Response `200`

The call was accepted.

- SecurityFindingIgnoreStatus
  - `status` string, required: Always `ok`, including when nothing changed.

## Other responses

- `401`: Missing or invalid credentials.
- `403`: You don't have editor access to this app, or you used a workspace API key. A read-only personal access token is refused.
- `404`: App not found.
- `422`: The body is missing or isn't a JSON object, has fields other than `fingerprint`, `finding_type`, `file_path`, and `title`, or leaves out `fingerprint` or `finding_type`. Also returned when a value isn't a string, is longer than its limit, or is empty for `fingerprint` or `finding_type`.
- `429`: Rate limit exceeded. The base limit is 60 requests per minute for each app, shared by every personal access token in the workspace. See [Rate limits](/developers/references/apps-api/get-started/rate-limits) for the multiplier your plan gets.

## Changes

> 58 revisions in range; 1 not diffed.

- **2026-10-12** `5e139db2e643`: 1 info
  - the endpoint scheme security `PersonalAccessTokenAuth` was added to the API
- **2026-09-29** `d2b7ac8beb0c`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/adexad/apis/base44-app-management-api/changes/api/apps/:app_id/security/scan/ignore/post.md)

---

[API](https://skmtc.dev/adexad/apis/base44-app-management-api.md) · [All operations](https://skmtc.dev/adexad/apis/base44-app-management-api/llms.txt) · [OpenAPI document](https://skmtc.dev/adexad/apis/base44-app-management-api/revisions/fa29e915c226?raw)